Mobile App Penetration Testing
Manual security testing of iOS and Android applications against the OWASP MASVS, covering the app binary, local data, transport security, and the APIs behind it.
Selva Ops S.R.L.
A mobile application penetration test examines the app as it actually ships: the compiled binary, the data it stores on the device, the way it talks to your backend, and the platform protections it relies on. Testing follows the OWASP Mobile Application Security Verification Standard (MASVS) and its testing guide, the MASTG.
What a mobile engagement covers
- Local data storage — what ends up on the device, how it is protected, what survives logout and uninstall.
- Transport security — TLS configuration, certificate pinning and its bypass resistance, cleartext traffic.
- Platform interaction — deep links, IPC, exported functionality, WebView configuration.
- Reverse engineering resistance — secrets in the binary, obfuscation, root/jailbreak detection where it matters for your threat model.
- The backend — the API endpoints the app consumes, tested with the same rigor as an API penetration test.
iOS and Android are different targets
The shared methodology above applies to both platforms, but the platform-specific work differs enough that each has its own page:
- iOS App Penetration Testing — Keychain usage, App Transport Security, jailbreak detection, Objective-C/Swift runtime manipulation.
- Android App Penetration Testing — Keystore usage, exported components, WebView pitfalls, rooting and Frida-based instrumentation.
If your product ships on both platforms, a combined engagement tests both clients against one backend and is scoped accordingly — you do not pay twice for the shared API work.
What you receive
- A report with reproduction steps, evidence, and severity ratings for every finding
- Findings mapped to OWASP MASVS controls
- Remediation guidance for both the mobile client and its backend
- Retest of fixed findings and an updated report
- An attestation letter suitable for customers and auditors
Standards and references
Compliance context
FAQ
- Do you need the source code of the app?
- No. Testing works from the compiled app (IPA/APK/AAB). Source access is welcome and improves depth — findings can then reference the exact code location — but it is not required.
- Do you test the backend APIs too?
- Yes, within the agreed scope. A mobile app is a client to an API; most impactful findings live on the server side, so mobile engagements normally include the API endpoints the app consumes.